# Alternative reverse-proxy: nginx. PEM files land on the host exactly like the
# Apache+certbot scenario — nginx and certbot are close cousins here, both
# writing/reading plain PEM under /etc/letsencrypt.
#
# This is a FRAGMENT, not a full replacement for ../docker-compose.yml: it
# adds an nginx + certbot pair and removes the panel's host port publish (nginx
# takes over 80/443 and proxies to the panel over the compose network
# instead). Merge it with the base file — run this from the deploy/ directory
# (Compose resolves every relative path in both files against the directory of
# the FIRST -f file, i.e. deploy/, which is why paths below are ./nginx/... -
# docs.docker.com/compose/how-tos/multiple-compose-files/merge/: "Paths are
# evaluated relative to the base file"):
#
#   docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml up -d
#
# First-run certificate issuance (webroot method, before nginx has a cert to
# serve — run once):
#   docker compose -f docker-compose.yml -f nginx/docker-compose.nginx.yml \
#     run --rm certbot certonly --webroot -w /var/www/certbot \
#     -d mail.example.com --email you@example.com --agree-tos --no-eff-email

services:
  selfpost:
    ports: !override
      - "465:465"
      - "587:587"
      - "25:25"
      # No host publish for 8080 here: nginx reaches it over the compose
      # network at selfpost:8080 instead (see nginx.conf.example).
    volumes: !override
      - ./data:/data
      - .:/selfpost-deploy:ro
      # certs/ holds two links, fullchain.pem and privkey.pem, to
      # /etc/letsencrypt/live/mail.example.com/ - a path inside the
      # container: certbot's directory below is mounted there whole, because
      # its live/ files are relative links into archive/ (mounting live/ alone
      # left them pointing at nothing). docs/guide.md, "Reverse proxy", nginx.
      - ./certs:/etc/postfix/tls:ro
      - ./nginx/certbot-etc:/etc/letsencrypt:ro

  nginx:
    image: nginx:1.27
    restart: unless-stopped
    depends_on:
      - selfpost
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf.example:/etc/nginx/conf.d/selfpost.conf:ro
      - ./nginx/certbot-etc:/etc/letsencrypt:ro
      - ./nginx/certbot-www:/var/www/certbot:ro

  certbot:
    image: certbot/certbot:latest
    volumes:
      - ./nginx/certbot-etc:/etc/letsencrypt
      - ./nginx/certbot-www:/var/www/certbot
    # Renewal twice a day is certbot's own recommended cadence; it no-ops
    # until a certificate is within its renewal window.
    # (eff-certbot.readthedocs.io, User Guide, "Automated Renewals": the
    # sample cron runs "certbot renew" at 0 and 12 h; renew acts only on a
    # certificate near expiry.)
    entrypoint: sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done'